An auditor at Calder Health assesses overtime pay and compares actual payments against the criterion that all overtime must be pre-approved by a department head. Payroll records show 30 percent of overtime lacked pre-approval, but interviews reveal the approval workflow was disabled for two months during a system upgrade, with a manager reviewing hours afterwards. How should the auditor interpret this difference between criteria and condition?
- ATreat the 30 percent gap as a control failure of equal significance across the whole period under review.
- BDismiss the difference because a manager reviewed the hours afterwards, providing an adequate substitute control.
- CReport the raw deviation against the criterion without adjusting for the disabled workflow, to stay objective.
- DWeigh the deviation against its root cause and the compensating review to judge the residual risk and true effect. Correct
Why A is wrong: Tempting because the headline rate looks uniform, but a compensating manual review and a time-bounded cause change the real effect, so equal weighting overstates it.
Why B is wrong: Tempting since a compensating control exists, but after-the-fact review is weaker than pre-approval, so dismissing the gap ignores the residual risk it leaves.
Why C is wrong: Tempting as it seems neutral, but ignoring a known cause and a compensating control misstates significance; objectivity requires evaluating the effect, not just the deviation.
Why D is correct: Correct because significance depends on cause and effect together; the timed outage and the manual review reduce, though do not remove, the residual risk the finding represents.